Configuring allowed repositories

With Gatekeeper you can set a constraint that requires only allowed repositories to be used to download images. For example, this constraint can be useful if company policies require downloading images only from trusted repositories, so that cluster operators do not accidentally run an untrusted application from an untrusted source.

To demostrate how Gatekeeper works several objects will be created:

• A constraint template and its corresponding constraint. It will only allow images to be downloaded from the Docker Hub repository.
• A few Kubernetes resources to test how the constraint works.

1. Create a Kubernetes cluster of the latest version, if not done so already.

   Choose the cluster parameters at your own discretion.

2. Make sure that you can connect to the cluster with kubectl.

1. Create a constraint template:

   1. Create a constraint template manifest.

      Use the contents of this file. This is a ready-made template K8sAllowedRepos from the Gatekeeper library, which checks that images are only downloaded from trusted repositories.

   2. Create a constraint template based on the template manifest:

       
      kubectl apply -f template.yaml

2. Create a constraint:

   1. Create a constraint manifest constraint based on the template you created earlier:

      constraint.yaml

   2. Create a constraint based on the constraint manifest:

       
      kubectl apply -f constraint.yaml

3. Make sure that the constraint template and the constraint have been successfully created by running the command:

    
   kubectl get constraints,constrainttemplates

   Output should give you the similar information:

    
   NAME                                                          ENFORCEMENT-ACTION TOTAL-VIOLATIONSk8sallowedrepos.constraints.gatekeeper.sh/require-docker-hub  ...                ...NAME                                                          AGEconstrainttemplate.templates.gatekeeper.sh/k8sallowedrepos    ...

4. Test the restriction by trying to create several pods:

   Pod that satisfies the constraint

   Pod that does not satisfy the constraint

   1. Create a manifest for the pod:

      example-allowed.yaml

   2. Try to create a pod based on the manifest:

       
      kubectl apply -f example-allowed.yaml

      The operation should be completed successfully.

   3. Make sure that the pod has been successfully created by running the command:

       
      kubectl get pod allowed-pod

      Output should give you the similar information:

       
      NAME          READY   STATUS    RESTARTS   AGEallowed-pod   1/1     Running   ...        ...

   1. Create a manifest for the pod:

      example-disallowed.yaml

   2. Try to create a pod based on the manifest:

       
      kubectl apply -f example-disallowed.yaml

      The operation should end with an error:

       
      Error from server (Forbidden): error when creating "example-disallowed.yaml": admission webhook "validation.gatekeeper.sh" denied the request: [require-docker-hub] container <nginx> has an invalid image repo <quay.io/jitesoft/nginx:latest>, allowed repos are ["docker.io/"]

   3. Make sure that the pod has not been created by running the command:

       
      kubectl get pod disallowed-pod

      Output should give you the similar information:

       
      Error from server (NotFound): pods "disallowed-pod" not found

A running cluster consumes computing resources and is charged accordingly. If you no longer need the Kubernetes resources you created to test constraints, delete them:

1. Delete the created allowed-pod pod, the constraint template, and the constraint itself:

   Linux/macOS

   Windows

    
   kubectl delete pod allowed-podkubectl delete k8sallowedrepos.constraints.gatekeeper.sh/require-docker-hubkubectl delete constrainttemplate.templates.gatekeeper.sh/k8sallowedrepos

    
   kubectl delete pod allowed-pod; `kubectl delete k8sallowedrepos.constraints.gatekeeper.sh/require-docker-hub; `kubectl delete constrainttemplate.templates.gatekeeper.sh/k8sallowedrepos

2. Stop the cluster you created to use it later or delete it permanently.